diff --git a/tools/assets/ace/static.js b/tools/assets/ace/static.js
index e9f69e6..37dafa9 100755
--- a/tools/assets/ace/static.js
+++ b/tools/assets/ace/static.js
@@ -32,6 +32,11 @@ if (allowSave)
 http.createServer(function(req, res) {
     var uri = unescape(url.parse(req.url).pathname);
     var filename = path.join(process.cwd(), uri);
+    if (path.normalize(unescape(req.url)) !== unescape(req.url)) {
+        res.statusCode = 403;
+        res.end();
+        return;
+    }
 
     if (req.method == "OPTIONS") {
         writeHead(res, 200);